<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
use Symfony\Component\HttpKernel\Exception\HttpException;

/**
 * Responsible for validating the request.
 */
class VerifyAppBridge
{

    /**
     * Undocumented function.
     *
     * @param Request $request The request object.
     * @param Closure $next    The next action.
     *
     * @throws HttpException If verification fails.
     *
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        $authHeader = $request->header('Authorization');

        if (empty($authHeader) || strlen($authHeader) < 50) {
            return response()->json(['error' => 'Unauthorized'], 401);
        }

        try {
            $token = substr($request->header('Authorization'), 7);

            $decoded = JWT::decode($token, new Key(config('shopify-app.api_secret'), 'HS256'));

            // Validate issuer and audience
            if (trim($decoded->aud) !== config('shopify-app.api_key')) {
                return response()->json(['error' => 'Unauthorized'], 401);
            }
        } catch (\Exception $e) {
            return response()->json(['error' => 'Unauthorized'], 401);
        }

        return $next($request);
    }
}